topic Re: Management inteface send packet port 137 to broadcast public IP in General Topics

Management inteface send packet port 137 to broadcast public IP

Register_Security — Fri, 23 Aug 2013 08:05:40 GMT

Hi all,

I monitor traffic on management interface of 3020, I have seen so many packet from management IP to an broadcast IP

Aug 23 14:49:24	192.168.1.15:35889	203.77.255.255:137	UDP
Aug 23 14:49:24	192.168.1.15:52601	203.77.255.255:137	UDP

I try to stop all service on management interface but it is not affect.

Please help me to stop these packet.

Thanks,

Re: Management inteface send packet port 137 to broadcast public IP

mikand — Mon, 26 Aug 2013 08:27:31 GMT

Do you have userid setup, that is if your PA-3020 is trying to reach some AD machine?

Re: Management inteface send packet port 137 to broadcast public IP

mbutt — Mon, 26 Aug 2013 22:32:37 GMT

Do you have user id enabled on public zone.

Here is a doc which explains why you might see alot of traffic to random public ip address with port 137.

https://live.paloaltonetworks.com/docs/DOC-4705

Let us know if this helped you resolve your issue.

Thanks

Numan

Re: Management inteface send packet port 137 to broadcast public IP

sjamaluddin — Wed, 28 Aug 2013 21:56:16 GMT

Have you made this PAN firewall part of an AD domain? UDP port 137 appears to be some NETBIOS traffic and its unlikely that the management port will be spewing that out unless this PA has been included as a domain device.

Re: Management inteface send packet port 137 to broadcast public IP

Register_Security — Tue, 17 Sep 2013 10:29:51 GMT

Thanks for all reply.

I found and fixed the problem.

The reason is PAN auto enable "Microsoft Active Directory" my domain.